Ofir Dagan

4 exploits Active since Apr 2020
CVE-2015-9544 WRITEUP HIGH WORKING POC
Cross Domain Local Storage < 2.0.5 - Improper Input Validation
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
CVSS 7.1
CVE-2015-9545 WRITEUP HIGH WORKING POC
Cross Domain Local Storage < 2.0.5 - Improper Input Validation
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
CVSS 7.1
CVE-2020-11610 WRITEUP HIGH WORKING POC
Cross Domain Local Storage < 2.0.5 - Exposure to Wrong Actor
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
CVSS 8.8
CVE-2020-11611 WRITEUP MEDIUM WORKING POC
Cross Domain Local Storage < 2.0.5 - Open Redirect
An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
CVSS 6.1